Ekubo EVM v2 Router — Approval-Based Token Drain Exploit

Timeline: On May 5, 2026 at approximately 22:18 UTC, an attacker exploited an IPayer.pay callback vulnerability in Ekubo Protocol's EVM v2 swap router, draining 17 WBTC (~$1.4M) from wallets that had granted prior token approvals to the router. The exploit was carried out through ~85 rapid transactions of 0.2 WBTC each. The attacker's wallet had been pre-funded via Railgun, indicating premeditation. Stolen WBTC was converted to WETH and DAI, then sent through Tornado Cash for laundering. Ekubo announced the breach via its official X account and confirmed that Starknet contracts were unaffected (the exploit was limited to the EVM deployment). Critically, the Ekubo EVM contracts are immutable, meaning the team must redeploy rather than patch. Ekubo launched a refund portal and Revoke.cash issued a dedicated approval-revocation tool. The investigation is effectively closed pending any potential attacker identification.